8.8

CVE-2023-2628

Exploit

KiviCare Management System < 3.2.1 - Multiple CSRF

KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Cross-Site Request Forgery

The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)
Mögliche Gegenmaßnahme
KiviCare – Clinic & Patient Management System (EHR): Update to version 3.2.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Iqonic ≫ Kivicare SwPlatformwordpress Version < 3.2.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt KiviCare – Clinic & Patient Management System (EHR)
Version *-3.2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.305
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/e0741e2c-c529-4815-8744-16e01cdb0aed
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/4101c35e-5af9-4372-9ed1-fb6a15d8500f
Third Party Advisory